How to filter CloudWatch Log Insights with ispresent() function

amazon-cloudwatch aws-cloudwatch-log-insights
Gustavo Lopes picture Gustavo Lopes · May 8, 2019 · Viewed 11.3k times · Source

I'm trying to perform a really simple query on the not so new AWS Cloudwatch Log Insights

I'm following their documentation to filter my logs using ispresent function.

The query is the following:

fields @timestamp, status
| filter ispresent(status) != 0

But this give me an error (the super unhelpful We are having trouble understanding the query)

How can I filter my logs by showing only the logs with the status field?

Answer

Gustavo Lopes picture Gustavo Lopes · May 9, 2019

After a while, I figured out how to do that, in a hackish way.

fields @timestamp, status, ispresent(status) as exist
| filter exist != 0

Not the best way (and it goes against their documentation), but works.

Related questions

How to query distinct from AWS log insights

I need to query data from lambda using AWS Cloudwatch log insights. The query syntax provide by aws doesn't have distinct. Only support (count_distinct(fieldname)) ref. https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax.html Example data …

Read More
CloudWatch Insights Query - How to get a single count from counts

I have a log file which contains playerId values, some players have multiple entries in the file. I want to get an exact distinct count of to unique players, regardless of if they have 1 or multiple entries in the log …

Read More
Filter by timestamp query on AWS Cloudwatch Logs Insights

I am trying to use AWS Cloudwatch Logs insights in order to search in some quite old logs of our lambda functions. I am reading this guide on AWS docs, but nowhere is documented how you can filter by timestamp. …

Read More